What’s New in SonarQube | Governance and Quality Gates at Scale
summary
SonarQube adds enterprise SCA with SBOM export and portfolio-level dependency risk plus license profile management that can break builds via quality gates and block merges for high-risk dependencies. An MCP server returns structured issue context to AI agents (available free on GitHub), letting agents autonomously refactor legacy debt during the first commit. The platform ships 1,000 new rules across 31 languages, expands analyzers (Rust, shell, YAML), and boosts secrets detection with over 450 secret patterns and 340+ rules; dashboards, PDF portfolio reports, Jira and Slack integrations, scoped org tokens, and IP allow lists round out governance.
AI-written summary · about
chapters (37)
- 0:00Introduction
- 0:54Software Composition Analysis (SCA) Explained
- 1:06Detecting Vulnerable and Risky Open-Source Dependencies
- 1:52SonarQube for IDE and SBOM Export Support
- 2:11Portfolio-Level Visibility into Dependency Risk
- 2:33License Profile Management and Policy Enforcement
- 3:03Quality Gates for Dependency and License Compliance
- 3:34SonarQube MCP Server for AI-Assisted Development
- 4:02Demo: AI Agent Remediating Legacy Technical Debt
- 4:18MCP Returning Structured Issue Context to the Agent
- 4:32AI Coding Agents Improving Code Quality from the First Commit
- 4:51MCP Server Availability and Pricing
- 5:04Expanding Language and Framework Support
- 5:40New Analyzer Support for Rust, Shell Scripts, YAML, and Properties Files
- 6:26Java, Python, and .NET Static Analysis Enhancements
- 6:46Expanded Coverage for Go, Ruby, and Apex
- 7:01Over 1,000 New Static Analysis Rules Across 31 Languages
- 7:14Expanded Secrets Detection Capabilities
- 7:46Secrets Protection Across the SonarQube Product Suite
- 8:01UI and Reporting Improvements for Developers and Executives
- 8:17Customizable Reporting for Code Health and Compliance
- 8:34Custom Dashboards Overview
- 8:52Built-In Project Health Dashboard
- 9:10Creating a Custom Dashboard from Scratch
- 9:39Charts, Widgets, and Filters for Trend and Severity Analysis
- 10:22Enterprise Availability of Custom Dashboards
- 10:42Portfolio Security Reports and Downloadable PDF Exports
- 11:10Reporting Support for Compliance Standards like STIG and CASA
- 11:27New Workflow Integrations for DevOps Teams
- 11:39Slack, Jira, and JFrog Integration Roadmap
- 12:00Jira Integration: Converting SonarQube Issues into Work Items
- 12:53Slack Notifications for Quality Gate Status Changes
- 13:17Enterprise Governance and Administrative Controls
- 13:38Scoped Organizational Tokens for Secure Access
- 14:16IP Allow Lists for Tighter Platform Access Control
- 14:37Enterprise LOC Allocation and Resource Management
- 15:00Closing and SonarQube Cloud Signup Call to Action
related talks
11mLove Your Security Engineer as Yourself
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
27mControl. Shift. Deliver. Take Command of your Software Supply Chain
15mCan LLMs generate Enterprise Quality Code?
47mRollercoaster of Security Automation
22mGuardians of Code: Continuously Monitoring Security and DevOps Compliance
32mAutomating Security Compliance at Scale
46mQuality & Security Gates in Our CI⚡CD Pipelines